How a Tiny $50 Gadget Is Thwarting Hackers in 160 Countries

A Swedish product designer built the go-to cybersecurity device for companies in Silicon Valley--and across the globe.

Stina Ehrensvard got her big break in 2011, when Google, after seeing a demonstration of the YubiKey, purchased tens of thousands of them for its employees.

CREDIT: Anastasiia Sapon

When Stina Ehrensvard opened an account with an online bank and was issued a user name, password, and complex security software to be installed on her computer, what the bank didn't know was that her husband was a white-hat hacker--the kind who breaks into networks to test their security. "He said it would take him about a day to write the code to hack into my account," Ehrensvard laughs.

The bank's impotence provided the impetus for Ehrensvard, a native Swede, to close her Stockholm technology-design consulting business and take on hackers everywhere. In 2008, her cyber-security company, Yubico, debuted the YubiKey, a $40 to $50 thumb drive-like dongle that authenticates a user and is as simple to use as plugging a keyboard into a computer, without ever requiring the installation of software. Simply put, a would-be hacker on the other side of the world would still need the user's YubiKey to log in to his or her account. "The internet was not built for security; it was built for sharing," says Ehrensvard, who also created the first intelligent pharmaceutical packaging, called Cypak.

Today, YubiKey is the de facto security device for companies in 160 countries, including Facebook, Dropbox, and Salesforce. The profitable firm, based in Palo Alto, California and Stockholm, is doubling sales every year in a category projected to exceed $1 trillion in global revenue over the next five years. Says Ehrensvard, "We don't solve all the problems, but we solve the major problem."

Editors note: The following is an additional excerpt from Inc.'s interview with Stina Ehrensvard on the challenges of getting funded.

Ehrensvard: For every entrepreneur, it is really difficult to build a brand, product, customer base, with nothing, especially when you're trying to build trust. But selling a security product is even more difficult, compared to say, a gaming app. If a gaming app breaks, nothing is really at stake. If a security app breaks, the stakes are obviously really high. It took time for us to build that long-term trust and customer base.

It also took a long time to get our first customers at scale, and because of that, it took a long time to convince investors. After we got Google as a client, they published a paper that said they used Yubikey for all their contractors and staff, and that it cut fraud and improved productivity. Not long after that, Facebook put out a video about why they chose Yubikey instead of biometric devices and smartcards. It's so much easier to establish credibility when you have companies of that stature saying that.

I don't want to mention any names, but when we moved to Silicon Valley [from Stockholm], I met with top investors who said that they didn't like hardware or open-source. They liked apps, returning revenue, and subscription models, which is ideal for them because people continue to pay. But every year, we invent new stuff. Most of our customers want to come and buy more, for computer login, access to servers and services, to secure servers.

Three years ago, we were lucky to be introduced to an investor, Ram Shriram, one of the founding board members of Google. By that time, we had already sold to Google and Facebook. He joined the board and invested in the company, and also brought on Marc Benioff, founder and CEO of Salesforce. In that way, I got my first sort of high-profile investors.

Those investors who turned me down? They all came back. In fact, one of them is currently in the process of buying secondary shares. We've become interesting to them, and we haven't changed our business model. Now they're like, What can we do for you? And we're able to say: we don't need you, but we can use your help.

The advice that I give to entrepreneurs is: go and build your product and then let investors find you. When you focus on the product first, you'll secure three things, automatically: You have customers who pay your bills; you solidify your product and focus; and you have much more control over your destiny. Investors can be fantastic, but they can also make things difficult.